Skip to content

Commit da2472a

Browse files
TomArcherMsftTomArcherMsft
committed
201-k8s-cluster-with-aks-applicationgateway-ingress
1 parent c06f51b commit da2472a

File tree

5 files changed

+404
-0
lines changed

5 files changed

+404
-0
lines changed

‎quickstart/201-k8s-cluster-with-aks-applicationgateway-ingress/main.tf‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
terraform {
2+
required_providers {
3+
azurerm = {
4+
source = "hashicorp/azurerm"
5+
version = "~>2.0"
6+
}
7+
}
8+
backend "azurerm" {
9+
resource_group_name = var.resource_group_name
10+
storage_account_name = var.storage_account_name
11+
container_name = "tfstate"
12+
key = "codelab.microsoft.tfstate"
13+
}
14+
}
15+
16+
provider "azurerm" {
17+
features {}
18+
}

‎quickstart/201-k8s-cluster-with-aks-applicationgateway-ingress/output.tf‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
output "client_key" {
2+
value = azurerm_kubernetes_cluster.k8s.kube_config.0.client_key
3+
}
4+
5+
output "client_certificate" {
6+
value = azurerm_kubernetes_cluster.k8s.kube_config.0.client_certificate
7+
}
8+
9+
output "cluster_ca_certificate" {
10+
value = azurerm_kubernetes_cluster.k8s.kube_config.0.cluster_ca_certificate
11+
}
12+
13+
output "cluster_username" {
14+
value = azurerm_kubernetes_cluster.k8s.kube_config.0.username
15+
}
16+
17+
output "cluster_password" {
18+
value = azurerm_kubernetes_cluster.k8s.kube_config.0.password
19+
}
20+
21+
output "kube_config" {
22+
value = azurerm_kubernetes_cluster.k8s.kube_config_raw
23+
sensitive = true
24+
}
25+
26+
output "host" {
27+
value = azurerm_kubernetes_cluster.k8s.kube_config.0.host
28+
}
29+
30+
output "identity_resource_id" {
31+
value = azurerm_user_assigned_identity.testIdentity.id
32+
}
33+
34+
output "identity_client_id" {
35+
value = azurerm_user_assigned_identity.testIdentity.client_id
36+
}

‎quickstart/201-k8s-cluster-with-aks-applicationgateway-ingress/resources.tf‎

Lines changed: 211 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,211 @@
1+
# # Locals block for hardcoded names.
2+
locals {
3+
backend_address_pool_name = "${azurerm_virtual_network.test.name}-beap"
4+
frontend_port_name = "${azurerm_virtual_network.test.name}-feport"
5+
frontend_ip_configuration_name = "${azurerm_virtual_network.test.name}-feip"
6+
http_setting_name = "${azurerm_virtual_network.test.name}-be-htst"
7+
listener_name = "${azurerm_virtual_network.test.name}-httplstn"
8+
request_routing_rule_name = "${azurerm_virtual_network.test.name}-rqrt"
9+
app_gateway_subnet_name = "appgwsubnet"
10+
}
11+
12+
data "azurerm_resource_group" "rg" {
13+
name = var.resource_group_name
14+
}
15+
16+
# User Assigned Identities
17+
resource "azurerm_user_assigned_identity" "testIdentity" {
18+
resource_group_name = data.azurerm_resource_group.rg.name
19+
location = data.azurerm_resource_group.rg.location
20+
21+
name = "identity1"
22+
23+
tags = var.tags
24+
}
25+
26+
resource "azurerm_virtual_network" "test" {
27+
name = var.virtual_network_name
28+
location = data.azurerm_resource_group.rg.location
29+
resource_group_name = data.azurerm_resource_group.rg.name
30+
address_space = [var.virtual_network_address_prefix]
31+
32+
subnet {
33+
name = var.aks_subnet_name
34+
address_prefix = var.aks_subnet_address_prefix
35+
}
36+
37+
subnet {
38+
name = "appgwsubnet"
39+
address_prefix = var.app_gateway_subnet_address_prefix
40+
}
41+
42+
tags = var.tags
43+
}
44+
45+
data "azurerm_subnet" "kubesubnet" {
46+
name = var.aks_subnet_name
47+
virtual_network_name = azurerm_virtual_network.test.name
48+
resource_group_name = data.azurerm_resource_group.rg.name
49+
depends_on = [azurerm_virtual_network.test]
50+
}
51+
52+
data "azurerm_subnet" "appgwsubnet" {
53+
name = "appgwsubnet"
54+
virtual_network_name = azurerm_virtual_network.test.name
55+
resource_group_name = data.azurerm_resource_group.rg.name
56+
depends_on = [azurerm_virtual_network.test]
57+
}
58+
59+
# Public Ip
60+
resource "azurerm_public_ip" "test" {
61+
name = "publicIp1"
62+
location = data.azurerm_resource_group.rg.location
63+
resource_group_name = data.azurerm_resource_group.rg.name
64+
allocation_method = "Static"
65+
sku = "Standard"
66+
67+
tags = var.tags
68+
}
69+
70+
resource "azurerm_application_gateway" "network" {
71+
name = var.app_gateway_name
72+
resource_group_name = data.azurerm_resource_group.rg.name
73+
location = data.azurerm_resource_group.rg.location
74+
75+
sku {
76+
name = var.app_gateway_sku
77+
tier = "Standard_v2"
78+
capacity = 2
79+
}
80+
81+
gateway_ip_configuration {
82+
name = "appGatewayIpConfig"
83+
subnet_id = data.azurerm_subnet.appgwsubnet.id
84+
}
85+
86+
frontend_port {
87+
name = local.frontend_port_name
88+
port = 80
89+
}
90+
91+
frontend_port {
92+
name = "httpsPort"
93+
port = 443
94+
}
95+
96+
frontend_ip_configuration {
97+
name = local.frontend_ip_configuration_name
98+
public_ip_address_id = azurerm_public_ip.test.id
99+
}
100+
101+
backend_address_pool {
102+
name = local.backend_address_pool_name
103+
}
104+
105+
backend_http_settings {
106+
name = local.http_setting_name
107+
cookie_based_affinity = "Disabled"
108+
port = 80
109+
protocol = "Http"
110+
request_timeout = 1
111+
}
112+
113+
http_listener {
114+
name = local.listener_name
115+
frontend_ip_configuration_name = local.frontend_ip_configuration_name
116+
frontend_port_name = local.frontend_port_name
117+
protocol = "Http"
118+
}
119+
120+
request_routing_rule {
121+
name = local.request_routing_rule_name
122+
rule_type = "Basic"
123+
http_listener_name = local.listener_name
124+
backend_address_pool_name = local.backend_address_pool_name
125+
backend_http_settings_name = local.http_setting_name
126+
}
127+
128+
tags = var.tags
129+
130+
depends_on = [azurerm_virtual_network.test, azurerm_public_ip.test]
131+
}
132+
133+
```hcl
134+
resource "azurerm_role_assignment" "ra1" {
135+
scope = data.azurerm_subnet.kubesubnet.id
136+
role_definition_name = "Network Contributor"
137+
principal_id = var.aks_service_principal_object_id
138+
139+
depends_on = [azurerm_virtual_network.test]
140+
}
141+
142+
resource "azurerm_role_assignment" "ra2" {
143+
scope = azurerm_user_assigned_identity.testIdentity.id
144+
role_definition_name = "Managed Identity Operator"
145+
principal_id = var.aks_service_principal_object_id
146+
depends_on = [azurerm_user_assigned_identity.testIdentity]
147+
}
148+
149+
resource "azurerm_role_assignment" "ra3" {
150+
scope = azurerm_application_gateway.network.id
151+
role_definition_name = "Contributor"
152+
principal_id = azurerm_user_assigned_identity.testIdentity.principal_id
153+
depends_on = [azurerm_user_assigned_identity.testIdentity, azurerm_application_gateway.network]
154+
}
155+
156+
resource "azurerm_role_assignment" "ra4" {
157+
scope = data.azurerm_resource_group.rg.id
158+
role_definition_name = "Reader"
159+
principal_id = azurerm_user_assigned_identity.testIdentity.principal_id
160+
depends_on = [azurerm_user_assigned_identity.testIdentity, azurerm_application_gateway.network]
161+
}
162+
```
163+
164+
resource "azurerm_kubernetes_cluster" "k8s" {
165+
name = var.aks_name
166+
location = data.azurerm_resource_group.rg.location
167+
dns_prefix = var.aks_dns_prefix
168+
169+
resource_group_name = data.azurerm_resource_group.rg.name
170+
171+
linux_profile {
172+
admin_username = var.vm_user_name
173+
174+
ssh_key {
175+
key_data = file(var.public_ssh_key_path)
176+
}
177+
}
178+
179+
addon_profile {
180+
http_application_routing {
181+
enabled = false
182+
}
183+
}
184+
185+
default_node_pool {
186+
name = "agentpool"
187+
node_count = var.aks_agent_count
188+
vm_size = var.aks_agent_vm_size
189+
os_disk_size_gb = var.aks_agent_os_disk_size
190+
vnet_subnet_id = data.azurerm_subnet.kubesubnet.id
191+
}
192+
193+
service_principal {
194+
client_id = var.aks_service_principal_app_id
195+
client_secret = var.aks_service_principal_client_secret
196+
}
197+
198+
network_profile {
199+
network_plugin = "azure"
200+
dns_service_ip = var.aks_dns_service_ip
201+
docker_bridge_cidr = var.aks_docker_bridge_cidr
202+
service_cidr = var.aks_service_cidr
203+
}
204+
205+
role_based_access_control {
206+
enabled = var.aks_enable_rbac
207+
}
208+
209+
depends_on = [azurerm_virtual_network.test, azurerm_application_gateway.network]
210+
tags = var.tags
211+
}

‎quickstart/201-k8s-cluster-with-aks-applicationgateway-ingress/terraform.tfvars‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
resource_group_name = "<Name of the Resource Group already created>"
2+
3+
location = "<Location of the Resource Group>"
4+
5+
aks_service_principal_app_id = "<Service Principal AppId>"
6+
7+
aks_service_principal_client_secret = "<Service Principal Client Secret>"
8+
9+
aks_service_principal_object_id = "<Service Principal Object Id>"

0 commit comments

Comments
 (0)